Splunk Search

Display the process that has top %_Processor_Time usage.


How to display the top 10 Processes that has high %_Processor_Time.

index=winserver_process sourcetype="PerfmonMk:RunningProcesses" NOT instance=Idle NOT instance=_Total earliest=-5m@m | eval Process=upper(instance) | top Process limit=10

What does this "top Process" command do? how to find the process that has high %_Processor_Time utilization?

Does anyone know the answer? Thanks in advance!

Tags (1)
0 Karma

Path Finder

You first need to sort the processes by %_Processor_time before using top. Something like

| sort - %_Processor_Time | top Process limit=10

The top command just gives you the first 10 lines of the results.

0 Karma
Get Updates on the Splunk Community!

Infographic provides the TL;DR for the 2023 Splunk Career Impact Report

We’ve been shouting it from the rooftops! The findings from the 2023 Splunk Career Impact Report showing that ...

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...